env-local@18.4.2: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 5d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13694 confirms this npm version as malicious. env-local impersonates the popular dotenv package: package.json points at motdotla/dotenv and main.js is a near-verbatim dotenv clone with an added require("./tui-options"). On require(), lib/tui-options.js unconditionally captures the installer's screen every 3 seconds and POSTs the images plus hostname, platform, and screen resolution to a hardcoded ngrok tunnel at...

Advisory

MAL-2026-13694

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in env-local (npm)

Details

env-local impersonates the popular dotenv package: package.json points at motdotla/dotenv and main.js is a near-verbatim dotenv clone with an added require("./tui-options"). On require(), lib/tui-options.js unconditionally captures the installer's screen every 3 seconds and POSTs the images plus hostname, platform, and screen resolution to a hardcoded ngrok tunnel at https://shorthand-shortlist-caress.ngrok-free.dev/upload. The same module polls https://shorthand-shortlist-caress.ngrok-free.dev/get_buffer once per second for a JSON buffer of mouse coordinates and keystrokes, then replays them locally via @nut-tree-fork/nut-js (mouse.setPosition, mouse.click, keyboard.pressKey), giving the remote operator interactive control of the installer's desktop. On Windows, the module writes a VBS launcher under %APPDATA%\ScreenCaptureClient and adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry entry named ScreenCaptureClient so the payload auto-executes at every user logon.

Decision reason

No blocking static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 20.7 KB of source

Source & flagged code

3 flagged

lib/tui-options.jsView file

1const { execFile, exec } = require('child_process'); L2: const fs = require('fs');

High

Child Process

Package source references child process execution.

lib/tui-options.jsView on unpkg · L1

90exec( L91: 'powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; Write-Output \\"$($s.Width)x$($s.Height)\\""', L92: (error, stdout, stderr) => {

High

Shell

Package source references shell execution.

lib/tui-options.jsView on unpkg · L90

1const { execFile, exec } = require('child_process'); L2: const fs = require('fs'); L3: const http = require('http'); L4: const https = require('https'); ... L15: const isMac = platform === 'darwin'; L16: const SERVER_IP = process.env.SERVER_IP || 'shorthand-shortlist-caress.ngrok-free.dev'; L17: const SERVER_URL = process.env.SERVER_URL || `https://${SERVER_IP}/upload`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/tui-options.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

lib/tui-options.jsView file

1const { execFile, exec } = require('child_process'); L2: const fs = require('fs');

High

Child Process

Package source references child process execution.

lib/tui-options.jsView on unpkg · L1

90exec( L91: 'powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; Write-Output \\"$($s.Width)x$($s.Height)\\""', L92: (error, stdout, stderr) => {

High

Shell

Package source references shell execution.

lib/tui-options.jsView on unpkg · L90

1const { execFile, exec } = require('child_process'); L2: const fs = require('fs'); L3: const http = require('http'); L4: const https = require('https'); ... L15: const isMac = platform === 'darwin'; L16: const SERVER_IP = process.env.SERVER_IP || 'shorthand-shortlist-caress.ngrok-free.dev'; L17: const SERVER_URL = process.env.SERVER_URL || `https://${SERVER_IP}/upload`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/tui-options.jsView on unpkg · L1

Findings

3 High2 Medium3 Low

HighChild Processlib/tui-options.js

HighShelllib/tui-options.js

HighSame File Env Network Executionlib/tui-options.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings